Connect GitLab
FlawPilot scans the source in your GitLab.com repositories, alongside the live-site scan. Connect once, choose what to track, and each scan reports insecure code, exposed secrets and vulnerable dependencies.
OAuth or a Personal Access Token
Before you start
- A FlawPilot account - the free tier is enough to connect a repository and run a scan.
- A GitLab.com account with access to the projects you want scanned.
- Self-hosted GitLab is not supported yet, so the instance must be GitLab.com.
How to connect
Connect your account
From Integrations in the FlawPilot portal, choose GitLab and connect with OAuth or a Personal Access Token. You can connect more than one GitLab account.
Pick repositories to track
In the repository picker, select the repos you actually want FlawPilot to know about. Everything else the grant can see stays out of view.
Assign a project and branch
For each tracked repo, assign a project and choose a branch from a searchable picker (the current branch is pinned first). Scans run against whichever branch is set here.
Run a code scan
With a project and branch assigned, the repo is scannable. Each scan reports insecure code, exposed secrets and vulnerable dependencies, scored independently.
Good to know
- OAuth is the fastest way in, or use a Personal Access Token.
- GitLab.com is supported today. Self-hosted GitLab support is coming soon.
- A repo becomes scannable only once it has a project and a branch assigned.
- If a credential goes invalid, expires, or is revoked, the connection shows “Reconnect needed” immediately, along with the failure reason.
- Visibility (public/private) and last-synced time are shown per tracked repo.
Once it is connected
A good first run, so you know the pipeline works before you add every repo.
- Connect one small project first and run a scan end to end before adding the rest.
- Point the branch at whatever you actually ship from - usually main.
- Re-run after a fix lands to confirm the finding clears.
If something does not work
The project picker is empty
The token or OAuth grant cannot see any projects. Check the scopes on your Personal Access Token, or that the grant covers the group the projects live in.
A group project does not appear
Group-owned projects need the connecting account to have access to that group. Ask a group owner to add you, or connect with a token that has the right scope.
The connection says “Reconnect needed”
The credential expired or was revoked. Reconnect from Integrations - the card shows the failure reason.
A project is connected but will not scan
It needs both a project and a branch assigned. Until both are set the repo is tracked but not scannable.
Connect another provider
GitHub, GitLab and Bitbucket can all be connected side by side, and each can hold more than one account.
See all integrations